Prison Pipeline

hackthebox

Task: Exploit a Node.js app with internal Verdaccio npm registry and periodic npm update cronjob. Solution: Use SSRF via node-libcurl file:// protocol to read .npmrc auth token, add registry hostname to /etc/hosts for nginx vhost routing, publish a backdoored prisoner-db package with bumped version, wait for cronjob to install it, then trigger RCE via the backdoor.